Read the docs
TI-2023-06959 Aliases CVE-2023-20255GHSA-mfw4-g24x-w66h

Improper input validation in Cisco Meeting Server

Priority LOW 26CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A vulnerability in an API of the Web Bridge feature of Cisco Meeting Server could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. This vulnerability is due to insufficient validation of HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP packets to an affected device. A successful exploit could allow the attacker to cause a partial availability condition, which could cause ongoing video calls to be dropped due to the invalid packets reaching the Web Bridge.

Why it matters now

EPSS 0.00813 57th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco Meeting ServerN/A—No fix listedCNA
  • Cisco Meeting Server VendorCisco Affected N/A Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cisco:meeting_server:*:*:*:*:*:*:*:*before 3.6.1VulnerableCisco
  • cpe:2.3:a:cisco:meeting_server:*:*:*:*:*:*:*:* Versions before 3.6.1 Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-20255
  2. 2026-10-03 Alias added: GHSA-mfw4-g24x-w66h

References

Advisory 1

  • TI-2016-05530 Memory corruption in Cisco Meeting Server before 2.0.3 and Acano Server before 1.9.5 CVSS 3.0CRITICAL 9.8
  • TI-2016-05529 Memory corruption in Cisco Meeting Server before 2.0.1, Acano Server before 1.9.3, Cisco… CVSS 3.0CRITICAL 9.8
  • TI-2018-00239 Improper input validation in Cisco Meeting Server Media Services CVSS 3.0HIGH 7.5
  • TI-2017-09025 Exposure of resource to wrong sphere in Cisco Meeting Server CVSS 3.0CRITICAL 9.1
  • TI-2018-00222 A vulnerability in Cisco Meeting Server could allow an unauthenticated, remote attacker… CVSS 3.0HIGH 8.1
  • TI-2016-05527 Improper input validation in Cisco Meeting Server before 2.0.6 and Acano Server before… CVSS 3.0CRITICAL 9.1
See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences